The majority of the configurable options are contained in the main project file. The screenshots below display these options (clicking on the HELP button from within the project displays information about what the individual options do) -
Core Scripts
This section contains two script actually visible to the end user -
Core Files - This script cannot be disabled. Most of the work is carried out in this script, including error checks, file checks, verifying source language/build/processor architecture, and copying and extracting the required files from the selected source (to a cache for later use).
There are a number of options in this script that fall into the category of minor tweaks - these are all enabled by default, however I've added them as options so that it's possible to remove them if required. Click on the HELP button(s) to find out more about each option. Adding them does not have any adverse effects even when the option doesn't work with the source being used. As an example the Browse for Folder option does not work with WinPE 2.*, however it doesn't cause any problems if the registry settings and files are added anyway.
LaunchBar - a program launcher created by Peter Lerup. "...LaunchBar is a small Windows freeware program that mimics the behavior of the dockable QuickLaunch toolbar that was available in all Windows versions before Windows 7...". Please refer to the LaunchBar website (see here) for more information.
If LaunchBar is enabled, individual program scripts will add entries to the LaunchBar configuration file. Start LaunchBar from the BBLean menu.
Screenshot of LaunchBar running in MistyPE -
Essential Scripts
The following are all what I consider Essential scripts - the majority of which do not require any external programs to be added. These scripts can be enabled or disabled as required, with the exception of the FileManager script which is mandatory -
FileManager - adds an explorer replacement to the build. Either Q-Dir or a43 can be selected. Q-Dir is a quad panel file manager developed by Hrg Nenad - Q-Dir website. If a43 is selected in 64-bit builds, FileManagerPE will actually be used. Bradley G. Miller is the author/developer of both a43 and FileManagerPE. Bradley has kindly consented to a43 being distributed with the project. a43 website
BCDEdit - BCDEdit is a command-line tool used to create and edit BCD stores - the boot configuration file used in all editions of Windows since the release of Windows Vista. At this time this script only adds some .txt based instructions to the build.
CMD Here - Start a command prompt from the right-click context menu.
Keyboard Layout - change the keyboard layout in WinPE whilst it's running. Uses wpeutil tool that is already included in the build.
Network - This will add a batch file + a menu entry to run it. The batch file runs the command "wpeinit InitializeNetwork" - this will Initialize network components and drivers, and set the computer name to a randomly-chosen value. This command is usually executed in startnet.cmd on a standard WinPE. I found that running this command causes an unnecessary delay when WinPE boots and therefore added it as a menu option so that it can be started if required.
ScreenRes - This will add a menu option for changing the screen resolution. No external programs are used, however a number of xml files are added - this option simply starts a batch file that will run the wpeinit command to change the screen resolution to a value set in the included xml files. A number of screen resolutions are available in the batch file.
Program Scripts
The following lists all of the program scripts that are included in Mini-WinFE. The majority of these applications are either included in the download or are downloaded from the internet on first run and cached for later use. You will need to provide your own files for use with the WinHex, FTK Imager, and X-Ways Forensics scripts.
Add Custom Batch and run at Start-up - add a custom batch file to the build. Edit the custom batch file via a button embedded in the script.
Included in download - N/A
Processor Architecture - N/A
Add Custom Folders\Files - select a directory and it's contents will be added to the build.
Included in download - N/A
Processor Architecture - N/A
7-Zip (version 16.04) - File archiver. Used to extract contents from .zip/.7z/.iso/.wim files and numerous other file types. Can also create .zip and .7z files. Right click a file in explorer to access menu options for extracting from or creating files. 7-zip website
Included in download - YES
Processor Architecture - x86 and x64
CloneDisk - Disk cloning/imaging utility with a host of additional features. CloneDisk website
Included in download - YES
Processor Architecture - x86 and x64
dd (Version 0.5) - Rawwrite dd for Windows by John Newbigin. A Windows port of the popular dd tool that can be used to copy files/disks/partitions or securely overwrite data. dd website
Included in download - YES
Processor Architecture - x86 only
DMDE (Version 3.2.0) - "...is a powerful software for data searching, editing, and recovery on disks. It may recover directory structure and files in some complicated cases through the use of special algorithms when other software can't help....DMDE has a number of freeware features such as disk editor, simple partition manager (e.g. allows undelete a partition), a tool to create disk images and clones, RAID constructor, file recovery from the current panel....DMDE supports FAT12/16, FAT32, NTFS, Ext2/3/4..." The Free Edition is included in the download - please refer to the License Agreement - here. DMDE website
Included in download - YES
Processor Architecture - x86 only
Forensic Acquisition Utilities (FAU) - "...a collection of utilities and libraries intended for forensic or forensic-related investigative use...". Includes a dd utility for imaging systems. Combined with NetCat (also included) it can image systems over a network. FAU is the property of GMG Systems, Inc. and is being reproduced with the kind permission of the author. GMG Systems, Inc. Please refer to the FAU End User License Agreement - here. FAU website
Included in download - YES
Processor Architecture - x86 and x64
FTK Imager Lite (Version 3.1.1) - Create a physical or logical image of any drive. This program can create an image using the raw, SMART or E01 formats. FTK Imager website
Included in download - NO
Processor Architecture - x86 and x64
HWiNFO (Version 5.4.6.0) - system diagnostic tool that can be used to check hardware. HWiNFO website
Included in download - YES
Processor Architecture - x86 and x64
Linux Reader - DiskInternals Linux Reader provides readonly access for Ext2/Ext3/Ext4, HFS and ReiserFS file systems. Although this program isn't included in the download the program script will attempt to download it from the developers website. This program will not be installed locally - the required files are extracted using 7-zip during the build process. Linux Reader website
Included in download - NO
Processor Architecture - x86 only
MWSnap (Version 3.0) - MWSnap is a small yet powerful Windows program for snapping (capturing) images from selected parts of the screen. This version is capable of capturing the whole desktop, a highlighted window, an active menu, or a fixed or free rectangular part of the screen. MWSnap handles 5 popular graphics formats and can be used to view BMP, JPG, TIFF, PNG and GIF formats. MWSnap website
Included in download - YES
Processor Architecture - x86 only
NT Password Editor (version 0.4) - NT Password Editor. This program can be used to edit passwords on a Windows NT based systems (Windows 2000, XP, Vista, 7, 8). Can be used to reset forgotten passwords and allow access to locked user accounts - it can only change or remove passwords for local system accounts. This program can NOT decrypt passwords or change domain and Active Directory passwords. NT Password Edit website
Included in download - YES
Processor Architecture - x86 and x64
Opera - Web Browser. Version 9.26.8835.0 is included in the download for x86 systems. An x64 version will be downloaded if required - although this program isn't included with the project the program script will attempt to download OperaUSB version 12. This program will not be installed locally - the required files are extracted using 7-zip during the build process.
Included in download - x86 only
Processor Architecture - x86 and x64
Sumatra - .PDF file reader. The Optimised build was included in the original release of this project as it included a native x64 version - something not at the time supported in the official release. The official Sumatra release now includes native 64-bit versions, however the Optimised builds have been retained due to their small footprint .SumatraOpt website
Included in download - YES
Processor Architecture - x86 and x64
Virtual Keyboard (Free VK) - A free, lightweight, multilingual and finger friendly virtual on-screen keyboard. FreeVK website
Included in download - YES
Processor Architecture - x86 only
Wallpaper -
Included in download - N/A
Processor Architecture - N/A
WinHex - versatile Hex editor. In addition to the common hex editor functions, this software can be used for computer forensics, data recovery, system imaging and restore and disk editing. WinHex website
Included in download - NO
Processor Architecture - x86 and x64
X-Ways Forensic - X-Ways Forensics is an advanced work environment for computer forensic examiners. X-Ways website
Included in download - NO
Processor Architecture - x86 and x64
WinFE - This is a mandatory script - adding the registry entries required to convert WinPE for use as a windows based Forensic Environment (WinFE). The Mini-WinFE project includes the following tools that can be used to easily change disk attributes (Read-Only / Read-Write and OFFLINE / ONLINE) -
WProtect.exe (Write Protect Tool) - developed by Colin Ramsden. This program can also be executed with command-line switches to mark all disks as Read-Only during the boot process. WProtect is not available as a native 64-bit application. It will work in 64-bit builds with SysWoW64 enabled, however the command-line switches do not appear to function in 64-bit environments. Please note that the Write Protect tool is distributed for non-profit use only.
DiskMgr - developed by Erwan.L. Available in native 32-bit and 64-bit version.
Either of the above programs can be used to mount a disk so that it can be written to - e.g. to copy an internal disk to an external disk. Care should be taken as it's also possible to remove the readonly flag from internal (evidence) disks - something that is not possible when using Diskpart in WinFE 4.0/5.0 systems.
Included in download - N/A
Processor Architecture - N/A
Shell.Then.End
A Shell is another term for the operating systems user interface (or UI). The default WinPE shell is the Windows Command Shell - a command-line user interface. This project uses the BlackBox Lean (version 1.17.1) shell to provide a menu driven UI.
Although the BBLean script is the only one visible to the user, another (hidden) script is executed to either repack boot.wim (if the EXTRACT method is selected) or add the amended files to an existing boot.wim (if the INJECT method is selected).
Boot.Media
The scripts in this section can either be selected during the build process, or can be executed independently afterwards - as long as the build completed successfully. Files in the %BaseDir%\WinFE.Project.Output\ directory (where %BaseDir% refers to the directory from which WinBuilder.exe is running) are used.
Please note that the Create USB and Create USB (GPT UEFI) scripts will not work if you are running the project on a Windows 2000/XP/2003 Operating System - if any of these operating systems are detected the script will abort..
Create ISO - this script includes a number of options, the default settings will create a RAM bootable ISO file using MKISOFS - for use on BIOS based systems. It's also possible to create a Flat Boot WinPE (WinPE 2.x/3.x only) or even a multiboot ISO file with options for RAM Boot and Flat Boot - bootable on UEFI and BIOS based systems.
Create USB - create a WinPE/WinFE bootable USB drive. Use with caution as the target drive will be repartitioned and formatted and this could result in data loss. The USB drive will use the MBR partition type but should still boot on a UEFI system - refer to Installing to a USB Drive for more details.
Create USB (GPT UEFI) - create a WinPE/WinFE bootable USB drive. Use with caution as the target drive will be repartitioned and formatted and this could result in data loss. The GPT partition type will be used - this will only boot on UEFI based systems. Removable type USB drives are not supported - Fixed type USB flash drives will work.
To execute any of the Boot.Media scripts simply select the required script and click on the small green play button to the right of the scripts icon -
Tools
The majority of the scripts in this section cannot be executed during the build process and are designed for pre/post processing - the exception is the Test in QEMU script.
Please note that the ADK script will not work if you are running the project on a Windows 2000/XP/2003 Operating System - if any of these operating systems are detected the script will abort.
Add Program - this script can be used to add additional programs/packages to the Mini-WinFE project. At the time of writing this script is of limited use as no packages are currently available.
Advanced Options - Can be used to mount/unmount the registry hives created when the Mini-WinFE project has finished the build process. This script can also be used to inject (add) additional files to boot.wim and carry out some additional tasks.
ADK - this script is covered in more detail here. Use this script to download and install the Assessment and Deployment Kit (for Windows 8 / 8.1 / 10.0.14393). It's possible to add any of the Optional Components supported in the ADK - adding support for PowerShell, .NET Framework, HTA, etc.
Cache Files - this script can be used to create a cache for use in the Mini-WinFE project. Depending on the local setup and source files available, it may be possible to copy required file dependencies from the HOST Operating System. The Cache Files script is covered in more detail here. This script can also be used to copy WinRE from a local drive - Windows 7/8/8.1 supported. Prior to Windows 7, WinRE had to be launched from the installation media. Windows 7 (and more recent versions of Windows) built WinRE into the Operating System - it's copied to a local hard disk as part of the installation process. Unfortunately WinRE might have been installed to it's own hidden partition - in which case this element of the script will not work.
Test in QEMU - test the ISO file created in the previous script in QEMU.
Update Project - this script can be used to check for and install any Mini-WinFE updates. If only project scripts have been updated between releases, then using this script will avoid the need to download a full package - the programs included with the Mini-WinFE download remain relatively static so this script will reduce bandwidth usage by avoiding the need for unnecessary downloads.
To execute any of the Tools scripts simply select the required script and click on the small green play button to the right of the scripts icon -
